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"The MAiUNG DATE of this communication appears on the cover sheet with the correspondence address - 

THE REPLY FILED 22 March 2004 FAILS TO PLACE THIS APPLICATION IN CONDITION FOR ALLOWANCE. 
Therefore, further action by the applicant is required to avoid abandonment of this application. A proper reply to a 
final rejection under 37 CFR 1.113 may only be either: (1) a timely filed amendment which places the application in 
condition for allowance; (2) a timely filed Notice of Appeal (with appeal fee); or (3) a timely filed Request for Continued 
Examination (RCE) in compliance with 37 CFR 1.114. 

PERIOD FOR REPLY [check either a) or b)] 

a) S The period for reply expires 3_months from the mailing date of the final rejection. 

b) n The period for reply expires on: (1 ) the mailing date of this Advisory Action, or (2) the date set forth in the final rejection, whichever is later. In no 

event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of the final rejection. 

ONLY CHECK THIS BOX WHEN THE FIRST REPLY WAS FILED WITHIN TWO MONTHS OF THE FINAL REJECTION. See MPEP 

706.07(0- 

Extensions of time may be obtained under 37 CFR 1 .1 36(a). The date on which the petition under 37 CFR 1 .1 36(a) and the appropriate extension fee 
have been filed is the date for purposes of determining the period of extension and the corresponding amount of the fee. The appropriate extension fee under 
37 CFR 1 .17(a) is calculated from: (1) the expiration date of the shortened statutory period for reply originally set in the final Office action; or (2) as set forth in 
(b) above, if checked. Any reply received by the Office later than three months after the mailing date of the final rejection, even If timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1 .704(b). 

1 .□ A Notice of Appeal was filed on . Appellant's Brief must be filed within the period set forth in 

37 CFR 1.192(a), or any extension thereof (37 CFR 1.191(d)), to avoid dismissal of the appeal. 

2. n The proposed amendment(s) will not be entered because: 

(a) □ they raise new issues that would require further consideration and/or search (see NOTE below); 

(b) □ they raise the issue of new matter (see Note below); 

(c) □ they are not deemed to place the application in better form for appeal by materially reducing or simplifying the 

issues for appeal; and/or 

(d) □ they present additional claims without canceling a conresponding number of finally rejected claims. 

NOTE: . 

3. n Applicant's reply has overcome the following rejection(s): . 



4. n Newly proposed or amended claim(s) would be allowable if submitted in a separate, timely filed amendment 

canceling the non-allowable claim(s). 

5. ^ The a)n affidavit, b)n exhibit, or c)^ request for reconsideration has been considered but does NOT place the 

application in condition for allowance because: Applicant's arguments are not persuasive (see Attachment) . 

60 The affidavit or exhibit will NOT be considered because it is not directed SOLELY to issues which were newly 
raised by the Examiner in the final rejection. 

7. ^ For purposes of Appeal, the proposed amendment(s) a)n will not be entered or b)^ will be entered and an 

explanation of how the new or amended claims would be rejected is provided below or appended. 

The status of the claim(s) is (or will be) as follows: 
Claim(s) allowed: None , 
Claim(s) objected to: None . 
Claim(s) rejected: 1-23 . 
Claim(s) withdrawn from consideration: None . 

8. n The drawing correction filed on is a)n approved or b)n disapproved by the Examiner. 

9. n Note the attached Information Disclosure Statement(s)( PTO-1449) Paper No(s). . 
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% Conklin teaches a method for processing network accounting Information, comprising receiving accounting information over a packet- 
switched network, monitoring at least one aspect of the received accounting information, and discarding at least a portion of the 

, accounting Information that occurs during a surge in network traffic, based on the monitored aspect. For example, network traffic 
measurement and monitoring for reporting information about captured packets reflecting activities of intrusions and detecting intrusions 
into the network and into computers connected to the network for denial of services [see Abstract and Figs. 6-9 and Col. 1, Line 10 - Col. 
2, Line 4 and Col. 5, Line 22 to Col. 6, Line 43]. With respect to Conklin, Conklln teaches capabilities of monitoring network intrusions in 
real-time [see Abstract] and logging monitoring events for appropriate response activities against Intrusions such as restoring lost data, 
removing unauthorized programs, or disconnecting the system from the network temporarily [see Col. 6, Lines 40-43] and therefor 
discarding at least a portion of the accounting information that occurs during a surge in network traffic [see Figs. 6-8 and Col. 5, Line 22 
to Col. 6, Line 43 and Col. 7, Line 45 to Col. 8, Line 20], based on the monitored aspect as claimed by applicant. 

In addition, Conklin teaches monitoring a rate of receipt of the accounting Information and whether the rate of receipt of the accounting 
information exceeds a predetermined amount . For example, Conklin teaches monitoring and collecting network data such as traffic over 
time and if network traffic is deemed outside of normal tolerances for measured characteristics, the the Intrusion detection will activate 
the alert notification, evidence logging and Incident analyzer reporter [see Figs, 6-8 and Col, 4, Line 30 to Col. 5, Line 9]. 

Therefore, the examiner asserts that Conklin teaches or suggests the subject matter broadly recited in Independent claims 1,11 and 20- 
22. Claim 23 is rejected under 35 U.S.C. § 103(a) as being unpatentable over Conklin in view of Savoldi and further in view of Trcka. 
Claims 2-10 and 12-19 are also rejected at least by virtue of their dependency on independent claims. Accordingly, claims 1-23 are 
respectfully rejected (see Paper No. 10) 
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